theowni/Damn-Vulnerable-RESTaurant-API-Game

completely ridiculous API (crAPI)

Vulnerable REST API with OWASP top 10 vulnerabilities for security testing

Damn Vulnerable Web Services is a vulnerable application with a web service and an API that can be used to learn about webservices/API related vulnerabilities.

A deliberately vulnerable banking application designed for practicing Security Testing of Web App, APIs, AI integrated App and secure code reviews. Features common vulnerabilities found in real-world applications, making it an ideal platform for security professionals, developers, and enthusiasts to learn pentesting and secure coding practices.

OWASP Juice Shop: Probably the most modern and sophisticated insecure web application

XVWA is a badly coded web application written in PHP/MySQL that helps security enthusiasts to learn application security.

OWASP Mutillidae II is a free, open-source, deliberately vulnerable web application providing a target for web-security training. This is an easy-to-use web hacking environment designed for labs, security enthusiasts, classrooms, CTF, and vulnerability assessment tool targets.

WebGoat is a deliberately insecure application

OWASP VulnerableApp Project: Break it. Scan it. Reproduce it. Benchmark against it. Improve it.